Crunchyroll Addresses User Concerns Following Data Breach

On March 23, news broke about a major data breach impacting Crunchyroll, the top anime streaming service. The initial reports came from an outlet that highlighted the breach, which was allegedly executed by a hacker who claimed to have infiltrated Crunchyroll on March 12. This was reportedly done by infecting the computer of an employee from an outsourcing firm that handles Crunchyroll’s support tickets. The hacker stated they used malware to compromise the employee’s system and obtain their credentials, leading to the download of eight million support ticket records, including nearly seven million unique email addresses.

Crunchyroll representatives were contacted on March 23, and a spokesperson provided a statement: “We are aware of recent claims and are currently working closely with leading cybersecurity experts to investigate the matter.”

On March 24, Crunchyroll issued an additional update regarding the situation:

“Our investigation is ongoing, and we continue to work with leading cybersecurity experts. At this time, we believe that the information is primarily limited to customer service ticket data following an incident with a third-party vendor. We have not identified evidence of ongoing access to systems in relation to these claims. We are continuing to monitor the situation closely.”

While the initial part of the statement acknowledges the hacker’s claims, Crunchyroll’s assurance that there is no ongoing access to their systems should provide some peace of mind to users. This also aligns with the assessment that the support tickets accessed by the hacker mainly contained general information, such as users’ names, login names, email addresses, IP addresses, general geographic locations, and the content of the support tickets. Additionally, while some reports suggested that credit card information was compromised, it has been confirmed that such details were only exposed if customers included them in their support tickets. Most instances involved basic information, like the last four digits or expiration dates, with only a few cases containing full card numbers, according to the hacker.